Arcus, a stock-token and perpetuals exchange on Robinhood Chain, says a bug in how it handled transfers between a user’s own subaccounts let one newly created account withdraw $2,234,391 in USDG it was not entitled to. The exchange has covered the shortfall from its own treasury and says no other user balances were affected. Most of the money appears to have left for Ethereum within an hour, and a large part of it was still sitting in the attacker’s wallet on Wednesday.
What Arcus says happened
The exploit began at about 03:07 UTC on Nov. 10, according to the exchange’s incident report, which dates it to the evening of Nov. 9 in U.S. Eastern time. Under specific conditions, the subaccount transfer bug let the account record a balance far larger than it actually held. It then requested withdrawals against that inflated balance.
A rate limit on the exchange’s bridge did some of the work. It capped payouts about three minutes after the exploit began and held back a further $3 million of requests, which were never paid out and were later reversed. Monitoring flagged the withdrawals at about 03:15 UTC. Arcus paused withdrawals across the platform at 04:07 UTC, deployed a fix at 04:37 UTC and blocked the exploiter’s addresses from trading, transferring and withdrawing six minutes later.
Withdrawals for everyone else came back at 09:26 UTC, and Arcus Labs covered the shortfall from its treasury later that day. Arcus said on Tuesday evening that trading and withdrawals were operating normally.
One detail in the report does not quite line up. Arcus says it detected and fixed the bug “within one hour.” Its own timeline puts the fix about 82 minutes after monitoring flagged the withdrawals, and 90 minutes after the exploit began. The pause, which is what stopped further losses, came about an hour in.
Where the money went
Arcus published the exploiter’s initial address and asked exchanges and service providers to flag any funds received from it. On Ethereum, that same address received about 1,052 ETH between 03:15 and 04:00 UTC on Nov. 10, Blockscout data shows. Roughly 922 ETH of that came through a contract the explorer labels as a Relay router, a crosschain bridging service. The timing and size fit the $2.23 million withdrawal, though Arcus itself has not described the route.
Later that day the address sent about 53 ETH into THORChain’s router contract across three transactions, the swap network that funds from the Binance hack also passed through earlier this month. As of Wednesday it still held about 475 ETH, worth roughly $980,000 at current prices. Arcus says it is working with blockchain investigators and will coordinate with law enforcement as appropriate.
A small venue with a real-world pitch
The loss matters relative to the size of the platform. DefiLlama lists Arcus with about $63.6 million in value locked on Robinhood Chain, which puts the withdrawal at roughly 3.5% of that figure. The exchange markets 24/7 trading in stock tokens alongside crypto perpetuals, and its homepage says it was built in partnership with Robinhood Chain.
This was not a smart contract hack in the usual sense. The flaw sat in the exchange’s own accounting of internal transfers, the kind of off-chain bookkeeping logic that is harder for outsiders to audit. The bridge rate limit was what kept a $2.23 million loss from becoming a $5 million one. PANews and other outlets have reported the incident based on the Arcus disclosure.
It also adds to a busy run of DeFi incidents. AltcoinReporter covered the Ankr bridge drain on Monday, where forged receipts took about $300,000 before the bridge was paused. Arcus says the fix has been reviewed by its security partners, along with related checks across its codebase, and that it is improving its systems for spotting suspicious activity.
FAQ
Did Arcus users lose money?
Arcus says no. Only one account was involved, no other balances, positions or orders were affected, and the company covered the $2.23 million shortfall from its treasury.
Can I withdraw from Arcus now?
Arcus said withdrawals were re-enabled on Nov. 10 and that trading and withdrawals are operating normally.
Have the stolen funds been recovered?
Not so far. Arcus says the funds are being tracked on-chain, and Blockscout shows the exploiter’s address still held about 475 ETH on Wednesday.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
